CVE-2026-63229 — Pre-authentication blind SQL injection vulnerability

CVE-2026-63229

Pre-authentication blind SQL injection vulnerability PUBLISHED

Description (CNA)

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover.

Affected (CNA)

Vendor / product	Versions
Three Learning / Koollab LMS	affected 5.3.2

CWE

No CWE identifiers supplied.

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.